Daily Virus Report (Mar 13, 2009) - Worm.Win32.DownLoader.ob
-
RISING
Mar 13, 2009 one virus needs your attention. It is OB(Worm.Win32.DownLoader.ob). The virus is very stubborn; though users take System Restore operation, this virus still exists in the infected computer. And this malicious virus shuts down antivirus software; and links to malicious websites to download varieties of Trojan to the infected device; this makes the virus difficult to be cleaned.
Name: OB (Worm.Win32.DownLoader.ob)
Warning level: Dangerous
Category: Worm
Affected System: Windows NT/2000/XP/2003
Description:
After being executed, the virus breaks restore settings option of some applications; this makes this malicious virus can be existed in the infected device even users took System Restore operation. The virus recovers system’s SSDT file by releasing drivers; breaks security software to escape from its scanning and checking. Also, the virus creates “AutoRun.inf” and “SafeSys.exe” files in each disk; so the virus will be launched while users double-click any disk. The virus changes registry startup option to achieve being launched with system. Finally, the virus connects to Internet, and downloads varieties of Trojans to infected device. So, the victim can be repeated infected easily by this virus; and this makes this virus difficult to be cleaned.
Anti-virus experts suggest that computer users take the following measures to protect against this virus:
1. Install Rising Internet Security or Rising Anti-virus, personal firewall, update in time, and at least 3 times per day for updating Rising.
2. Install Rising PC Doctor, and choose “Leaks” function to check the leaks or vulnerabilities exist in your computer operation system, patch your computer system in a timely manner as many viruses spread by taking advantage of the system exploits or vulnerabilities.
3. Do not browse suspicious websites, and suspicious inserter; turn off or delete unnecessary system services.
4. Do not receive the suspicious file from QQ, MSN, Email, etc.
5. Open RISING Active Defense and Auto-Protect function when accessing to the internet.
Daily Virus Report (Feb 07, 2012)- Rootkit.Win32.Undef.cvu ()
